Primary Menu

PSAD on Raspberry Pi

I have never gotten a full intrusion detection system (IDS) working correctly on a Raspberry Pi. The two most popular – Snort and Bro IDS – either have problems with their dependencies or the ARM architecture.

I recently came across PSAD – the Port Scan Attack Detector. It is essentially a collection of daemons that analyze iptables logs to identify patterns of malicious traffic. When used in conjunction with fwsnort, PSAD can also correlate blocked traffic with many of the "Emerging Threats" Snort rules.

PSAD was extremely easy to set up on a Raspberry Pi that's deployed as a catch-all DMZ host on my home network. Before diving into the details, you can see live data being collected by that host here: https://psad.disloops.com

In the tutorial above, UFW was set up as a wrapper over iptables. However, UFW logs do not have the level of detail that PSAD requires. Without modifying the logging capabilities, some messages may be discarded before PSAD can analyze them.

These lines will ensure that iptables events are logged properly. The --log-tcp-options argument adds additional data to the log files that can be used to detect certain attacks. The EXPECT_TCP_OPTIONS parameter in the PSAD configuration below corresponds to this setting.

The first two are self-explanatory. The ALERTING_METHODS setting accepts three values: noemail, nosyslog, and ALL. Here it's being set to suppress email alerts.

IPT_SYSLOG_FILE /var/log/ufw.log;

This just tells PSAD where to acquire iptables log data. The UFW configuration above was modified so that this data would be captured correctly.

EXPECT_TCP_OPTIONS Y;

Because some scanning tools don't set options in the TCP headers, using this setting allows PSAD to better identify those attacks. PSAD also uses this information to passively fingerprint remote operating systems. This setting depends on the --log-tcp-options argument provided in the UFW configuration files above.

IMPORT_OLD_SCANS Y;

This tells PSAD to re-import old scan data after a restart instead of moving it to the archive directory, which allows the statistics to remain persistent across reboots.

Lastly, have PSAD download the latest set of modified Snort signatures and reboot:

sudo psad --sig-updatesudo reboot

Setting up fwsnort

The fwsnort tool parses Snort rules and builds an equivalent iptables ruleset for as many rules as possible. Currently, fwsnort downloads and processes the "Emerging Threats" Snort ruleset.

Unfortunately, the iptables rules won't persist across a reboot. To save them, simply add the above script to rc.local so that it's run each time the system starts:

sudo vi /etc/rc.local

Just add /var/lib/fwsnort/fwsnort.sh above the line containing the exit command. Then reboot.

Note: Every other method of making iptables rules persistent did not work, including iptables-persistent and netfilter-persistent. You can ensure that the Snort rules have been added to iptables by running:

sudo fwsnort --ipt-list

Next Steps

The /var/log/psad directory contains some output files that provide data and statistics on incoming traffic. Running the following command will produce a file called status.out that compiles the more interesting details into a presentable format:

sudo psad --Status

There are some visualization tools available for PSAD but nothing that met my needs. Instead, I created a script that generates an HTML page from the data contained in the PSAD output files. You can download it here: PSADify on Github

Take a look at the output data and let me know if you have any observations!